{ pkgs, ... }:

{
  services.udev.packages = with pkgs; [ yubikey-personalization ];

  security.pam.services.sudo.u2fAuth = true;
  security.sudo.extraConfig = ''
    Defaults timestamp_timeout=0
  '';

  security.pam.u2f.appId = "pam://qyliss.net";
  security.pam.u2f.cue = true;
  security.pam.u2f.authFile = pkgs.copyPathToStore ./u2f_keys;
}